Senior Splunk Administrator

This is a fully remote position, open to applicants in United States.

📋 Description

• Design, develop, and implement processes for ingesting data from diverse sources into Splunk, including HEC, Splunk Stream, Technical Add-Ons, Universal Forwarder Collections, custom APIs, and other ingestion mechanisms.

• Configure and manage data inputs for logs, metrics, and events to ensure compliance with M-26-14 requirements at the FISMA system boundary level.

• Establish and maintain secure and reliable connections between Splunk and external systems or data sources.

• Create, monitor, and maintain alerts for failed data inputs.

• Develop and maintain custom Technical Add-Ons for non-standard ingestion paths utilizing API connections.

• Ensure proper authentication and authorization mechanisms for data transfer and system communication.

• Oversee the configuration and maintenance of Splunk infrastructure for optimal performance and security.

• Collaborate with cross-functional teams to troubleshoot and resolve issues related to Splunk.

• Conduct root cause analysis and implement preventive measures.

• Utilize Linux skills to manage and maintain the underlying operating system or cloud-based containers of Splunk servers and other security applications.

• Monitor tool health and performance to identify issues, bugs, or potential enhancements.

• Develop, review, and update operational documentation, including SOPs, job aids, application checklists, and playbooks.

• Support system access controls, including account management, access enforcement, information flow enforcement, least privilege, account requests, and account recertifications.

• Collaborate with SOC teams on process optimization, tool tuning, tool integration, information sharing, playbook development, and incident response.

• Perform implementation, administration, operations and maintenance, optimization, and integration of cybersecurity tools, technologies, and services.

• Conduct regular upgrades of Splunk Enterprise for deployment servers, heavy forwarders, and syslog servers.

⛳️ Requirements

• 4 years of experience in Information Technology.

• Bachelor of Science in Computer Science, Information Systems, Mathematics, Engineering, or a related degree, or an additional two (2) years of relevant experience.

• 3+ years of experience in Splunk administration or engineering.

• Proficiency in configuring and managing Splunk inputs, setting up data ingestion pipelines, and establishing system connections.

• Knowledge of Splunk's Search Processing Language (SPL), data parsing techniques, and regular expressions.

• Skilled in optimizing data pipelines for performance and efficiency, managing large data volumes, and implementing best practices for data integrity and consistency.

• Splunk Core Certified Consultant or Splunk Enterprise Certified Architect certification preferred.

• Splunk Enterprise or Splunk Cloud Certified Admin acceptable.

• Experience as an engineering team lead.

• Experience working with Splunk, syslog, syslog-ng, or systems designed to collect and centralize logs.

• Experience utilizing Cribl to optimize Splunk ingestion.

• Experience supporting teams with Fraud Analytics.

• Strong analytical and problem-solving abilities, with the capability to effectively prioritize and execute tasks.

🏝️ Benefits

• Valiant covers 99% of the Medical, Dental, and Vision premiums for Full-time Employees.

• Valiant contributes 25% towards Health Coverage for Family and Dependents.

• 100% Paid Short Term Disability and Life Insurance Policy for Full-time Employees.

• 100% Paid Certifications.

• 401K Matching up to 4%.

• Paid Time Off.

• Paid Federal Holidays.

• Wellness & Fitness Program.

• Valiant University – Online Education and Training Portal.

• FSA programs for Medical Costs, Dependent Care, Transit, and Parking.

• Referral Bonuses.